Include Hive operator NetworkPolicy in bundle/chart regeneration

[dislbenn]

Description

Hive's hack/bundle-gen.sh reads config/operator/operator_netpol.yaml only to populate CSV data in OperatorHub mode; it never emits the NetworkPolicy as a standalone manifest in the generated bundle. As a result, the Hive operator's NetworkPolicy was never picked up when regenerating the hive-operator Helm chart via make regenerate-charts-from-bundles, unlike every other toggle component which ships its NetworkPolicy through the standard bundle-to-chart flow.

Related Issue

N/A — found while auditing chart NetworkPolicy coverage across pkg/templates/charts/toggle/.

Changes Made

• Updated hack/bundle-automation/gen-hive-bundle.sh to copy config/operator/operator_netpol.yaml directly from the cloned Hive repo into the bundle output directory (renamed to hive-operator-networkpolicy.yaml) after the bundle manifests are copied.
• This lets the file flow through the existing bundle-to-chart tooling like any other manifest, automatically picking up the standard Helm templating ({{- if .Values.global.networkPolicies.enabled }} guard, namespace substitution) the same way other components (e.g. assisted-service) do.
• The script now fails hard (exit 3) if the file is missing upstream, so a future rename/removal in openshift/hive is caught immediately instead of silently dropping the NetworkPolicy.
• Included the resulting regenerated chart template: pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml.

Screenshots (if applicable)

N/A

Checklist

• I have tested the changes locally and they are functioning as expected.
• I have updated the documentation (if necessary) to reflect the changes.
• I have added/updated relevant unit tests (if applicable).
• I have ensured that my code follows the project's coding standards.
• I have checked for any potential security issues and addressed them.
• I have added necessary comments to the code, especially in complex or unclear sections.
• I have rebased my branch on top of the latest main/master branch.

Additional Notes

Verified end-to-end by running hack/bundle-automation/gen-hive-bundle.sh against openshift/hive master: the extracted hive-operator-networkpolicy.yaml matches Hive's source config/operator/operator_netpol.yaml exactly, and after running the chart regeneration tooling the file lands in pkg/templates/charts/toggle/hive-operator/templates/ with the same networkPolicies.enabled guard and namespace templating pattern used by other components' NetworkPolicy templates. The existing NetworkPolicy controller (controllers/networkpolicy.go) picks up chart templates automatically, so no controller changes are needed.

Reviewers

/cc

Definition of Done

• Code is reviewed.
• Code is tested.
• Documentation is updated.
• All checks and tests pass.
• Approved by at least one reviewer.
• Merged into the main/master branch.

Summary by CodeRabbit

• New Features
  • Added the Hive operator’s network policy to generated deployment bundles.
  • Added an optional Kubernetes network policy for Hive operator pods when network policies are enabled.
  • The policy permits required outbound traffic for Hive operator components, supporting environments where host-networked pods are used.
  • Bundle generation now reports an error when the operator network policy cannot be found or copied.

[openshift-ci]

@dislbenn: GitHub didn't allow me to request PR reviews from the following users: dislbenn.

Note that only stolostron members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Description

Hive's hack/bundle-gen.sh reads config/operator/operator_netpol.yaml only to populate CSV data in OperatorHub mode; it never emits the NetworkPolicy as a standalone manifest in the generated bundle. As a result, the Hive operator's NetworkPolicy was never picked up when regenerating the hive-operator Helm chart via make regenerate-charts-from-bundles, unlike every other toggle component which ships its NetworkPolicy through the standard bundle-to-chart flow.

Related Issue

N/A — found while auditing chart NetworkPolicy coverage across pkg/templates/charts/toggle/.

Changes Made

• Updated hack/bundle-automation/gen-hive-bundle.sh to copy config/operator/operator_netpol.yaml directly from the cloned Hive repo into the bundle output directory (renamed to hive-operator-networkpolicy.yaml) after the bundle manifests are copied.
• This lets the file flow through the existing bundle-to-chart tooling like any other manifest, automatically picking up the standard Helm templating ({{- if .Values.global.networkPolicies.enabled }} guard, namespace substitution) the same way other components (e.g. assisted-service) do.
• The script now fails hard (exit 3) if the file is missing upstream, so a future rename/removal in openshift/hive is caught immediately instead of silently dropping the NetworkPolicy.
• Included the resulting regenerated chart template: pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml.

Screenshots (if applicable)

N/A

Checklist

• I have tested the changes locally and they are functioning as expected.
• I have updated the documentation (if necessary) to reflect the changes.
• I have added/updated relevant unit tests (if applicable).
• I have ensured that my code follows the project's coding standards.
• I have checked for any potential security issues and addressed them.
• I have added necessary comments to the code, especially in complex or unclear sections.
• I have rebased my branch on top of the latest main/master branch.

Additional Notes

Verified end-to-end by running hack/bundle-automation/gen-hive-bundle.sh against openshift/hive master: the extracted hive-operator-networkpolicy.yaml matches Hive's source config/operator/operator_netpol.yaml exactly, and after running the chart regeneration tooling the file lands in pkg/templates/charts/toggle/hive-operator/templates/ with the same networkPolicies.enabled guard and namespace templating pattern used by other components' NetworkPolicy templates. The existing NetworkPolicy controller (controllers/networkpolicy.go) picks up chart templates automatically, so no controller changes are needed.

Reviewers

/cc

Definition of Done

• Code is reviewed.
• Code is tested.
• Documentation is updated.
• All checks and tests pass.
• Approved by at least one reviewer.
• Merged into the main/master branch.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: d4540461-153c-4c48-a554-b588a1a0dd61

📥 Commits

Reviewing files that changed from the base of the PR and between 8e7f21d and e5eba63.

📒 Files selected for processing (2)

• hack/bundle-automation/gen-hive-bundle.sh
• pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds a conditional Hive operator NetworkPolicy Helm template. Bundle automation also copies Hive’s NetworkPolicy manifest into the output directory and returns code 3 when the source or copy operation fails.

Changes

Hive NetworkPolicy support

Layer / File(s)	Summary
Render Hive operator NetworkPolicy pkg/templates/charts/toggle/hive-operator/templates/hive-operator-networkpolicy.yaml	When global.networkPolicies.enabled is true, the template renders an egress-only NetworkPolicy for Hive operator pods in global.namespace.
Bundle Hive NetworkPolicy manifest hack/bundle-automation/gen-hive-bundle.sh	The script copies Hive’s operator NetworkPolicy to hive-operator-networkpolicy.yaml. It returns code 3 when the source is missing or the copy fails.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e5eba

The requested Hive NetworkPolicy bundle and conditional chart rendering are supported by the verified source, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: including the Hive operator NetworkPolicy in bundle and chart regeneration.
Description check	✅ Passed	The description is complete and follows the repository template. It explains the purpose, changes, testing, checklist status, and regeneration details. The reviewer entry is empty, but this is a minor…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[dislbenn]

/cherry-pick backplane-5.0

[openshift-cherrypick-robot]

@dislbenn: once the present PR merges, I will cherry-pick it on top of backplane-5.0 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick backplane-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ngraham20]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dislbenn, ngraham20

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dislbenn,ngraham20]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dislbenn]

/test sonar-pre-submit

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[openshift-cherrypick-robot]

@dislbenn: new pull request created: #4021

Details

In response to this:

/cherry-pick backplane-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.